@infuro/cms-core 1.0.30 → 1.0.33

package/dist/migrations/1778660000002-VendorUserIdInviteStatus.ts

@@ -0,0 +1,61 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class VendorUserIdInviteStatus1778660000002 implements MigrationInterface {
+  name = 'VendorUserIdInviteStatus1778660000002';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      DO $$ BEGIN
+        CREATE TYPE "vendors_invitestatus_enum" AS ENUM ('none', 'pending', 'expired', 'accepted');
+      EXCEPTION WHEN duplicate_object THEN NULL;
+      END $$
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "vendors"
+      ADD COLUMN IF NOT EXISTS "userId" integer
+    `);
+    await queryRunner.query(`
+      ALTER TABLE "vendors"
+      ADD COLUMN IF NOT EXISTS "inviteStatus" "vendors_invitestatus_enum" NOT NULL DEFAULT 'none'
+    `);
+
+    await queryRunner.query(`
+      DO $$ BEGIN
+        ALTER TABLE "vendors" ADD CONSTRAINT "FK_vendors_userId"
+        FOREIGN KEY ("userId") REFERENCES "users"("id") ON DELETE SET NULL ON UPDATE NO ACTION;
+      EXCEPTION WHEN duplicate_object THEN NULL;
+      END $$
+    `);
+
+    await queryRunner.query(`
+      UPDATE "vendors" v
+      SET "userId" = vu."userId"
+      FROM "vendor_users" vu
+      WHERE v."userId" IS NULL
+        AND vu."vendorId" = v.id
+        AND vu.role = 'owner'
+    `);
+
+    await queryRunner.query(`
+      UPDATE "vendors" v
+      SET "inviteStatus" = CASE
+        WHEN u.blocked THEN 'pending'::"vendors_invitestatus_enum"
+        ELSE 'accepted'::"vendors_invitestatus_enum"
+      END
+      FROM "vendor_users" vu
+      INNER JOIN "users" u ON u.id = vu."userId"
+      WHERE vu."vendorId" = v.id
+        AND vu.role = 'owner'
+        AND v."userId" IS NOT NULL
+        AND v."inviteStatus" = 'none'::"vendors_invitestatus_enum"
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "vendors" DROP CONSTRAINT IF EXISTS "FK_vendors_userId"`);
+    await queryRunner.query(`ALTER TABLE "vendors" DROP COLUMN IF EXISTS "inviteStatus"`);
+    await queryRunner.query(`ALTER TABLE "vendors" DROP COLUMN IF EXISTS "userId"`);
+    await queryRunner.query(`DROP TYPE IF EXISTS "vendors_invitestatus_enum"`);
+  }
+}

package/dist/migrations/1778660000003-AddQrTokenToOrders.ts

@@ -0,0 +1,32 @@
+import { MigrationInterface, QueryRunner } from 'typeorm';
+
+export class AddQrTokenToOrders1778660000003
+  implements MigrationInterface
+{
+  name = 'AddQrTokenToOrders1778660000003';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      ALTER TABLE "orders"
+      ADD COLUMN "qrToken" character varying
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "orders"
+      ADD CONSTRAINT "UQ_orders_qrToken"
+      UNIQUE ("qrToken")
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      ALTER TABLE "orders"
+      DROP CONSTRAINT "UQ_orders_qrToken"
+    `);
+
+    await queryRunner.query(`
+      ALTER TABLE "orders"
+      DROP COLUMN "qrToken"
+    `);
+  }
+}

package/dist/migrations/1779100000000-ChatConversationLeadEmailSent.ts

@@ -0,0 +1,16 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+
+/** Tracks when a lead notification email was sent for a chat conversation (avoid duplicates). */
+export class ChatConversationLeadEmailSent1779100000000 implements MigrationInterface {
+  name = 'ChatConversationLeadEmailSent1779100000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "chat_conversations" ADD COLUMN IF NOT EXISTS "leadEmailSentAt" TIMESTAMP`
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "chat_conversations" DROP COLUMN IF EXISTS "leadEmailSentAt"`);
+  }
+}

package/dist/migrations/1779200000000-LlmAgentScope.ts

@@ -0,0 +1,72 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+
+/**
+ * Adds `llm_agents.scope` (chatbot, blog_creation, social_media_post, blog_metadata, email_intent_chatbot),
+ * backfills existing rows by slug, seeds the email-intent classifier agent, and enforces one active row per scope.
+ */
+const EMAIL_INTENT_AGENT_NAME = 'Chat Lead Intent Classifier';
+const EMAIL_INTENT_AGENT_SLUG = 'email-intent-chatbot';
+const EMAIL_INTENT_SCOPE = 'email_intent_chatbot';
+
+const EMAIL_INTENT_SYSTEM = `Classify the visitor message using the configured intent table.
+Prefer a specific business intent when the visitor shows clear buying, support, or partnership signals.
+Use NONE for greetings-only, FAQ, spam, or off-topic messages.`;
+
+export class LlmAgentScope1779200000000 implements MigrationInterface {
+  name = 'LlmAgentScope1779200000000';
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`
+      ALTER TABLE "llm_agents"
+      ADD COLUMN IF NOT EXISTS "scope" character varying
+    `);
+
+    await queryRunner.query(`
+      UPDATE "llm_agents"
+      SET "scope" = 'chatbot'
+      WHERE "deleted" = false AND "scope" IS NULL AND "slug" = 'site-chat-assistant'
+    `);
+    await queryRunner.query(`
+      UPDATE "llm_agents"
+      SET "scope" = 'blog_creation'
+      WHERE "deleted" = false AND "scope" IS NULL AND "slug" = 'blog-generator'
+    `);
+    await queryRunner.query(`
+      UPDATE "llm_agents"
+      SET "scope" = 'social_media_post'
+      WHERE "deleted" = false AND "scope" IS NULL AND "slug" = 'blog-generator-social'
+    `);
+    await queryRunner.query(`
+      UPDATE "llm_agents"
+      SET "scope" = 'blog_metadata'
+      WHERE "deleted" = false AND "scope" IS NULL AND "slug" = 'blog-generator-metadata'
+    `);
+
+    await queryRunner.query(
+      `
+      INSERT INTO "llm_agents" ("name", "slug", "scope", "system_instruction", "enabled", "createdAt", "updatedAt", "deleted")
+      SELECT $1::varchar, $2::varchar, $3::varchar, $4::text, true, now(), now(), false
+      WHERE NOT EXISTS (
+        SELECT 1 FROM "llm_agents" a
+        WHERE a."deleted" = false AND (a."scope" = $3::varchar OR a."slug" = $2::varchar)
+      )
+    `,
+      [EMAIL_INTENT_AGENT_NAME, EMAIL_INTENT_AGENT_SLUG, EMAIL_INTENT_SCOPE, EMAIL_INTENT_SYSTEM]
+    );
+
+    await queryRunner.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS "UQ_llm_agents_scope_active"
+      ON "llm_agents" ("scope")
+      WHERE "deleted" = false AND "scope" IS NOT NULL
+    `);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`DROP INDEX IF EXISTS "UQ_llm_agents_scope_active"`);
+    await queryRunner.query(`
+      DELETE FROM "llm_agents"
+      WHERE "slug" = $1 AND "scope" = $2
+    `, [EMAIL_INTENT_AGENT_SLUG, EMAIL_INTENT_SCOPE]);
+    await queryRunner.query(`ALTER TABLE "llm_agents" DROP COLUMN IF EXISTS "scope"`);
+  }
+}

package/dist/theme.d.cts

@@ -1,5 +1,5 @@
-import { C as ComponentMeta, T as ThemeConfig, N as NavbarConfig, F as FooterConfig } from './types-D34wmivy.cjs';
-export { L as LayoutConfig, a as NavItem, P as PropDefinition, b as PropType, c as ThemeComponent } from './types-D34wmivy.cjs';
+import { C as ComponentMeta, c as ThemeConfig, a as NavbarConfig, F as FooterConfig } from './types-DCVaXlPV.cjs';
+export { L as LayoutConfig, N as NavItem, P as PropDefinition, b as PropType, T as ThemeComponent } from './types-DCVaXlPV.cjs';
 import React$1 from 'react';
 
 declare function createTheme(config: ThemeConfig): ThemeConfig;

package/dist/theme.d.ts

@@ -1,5 +1,5 @@
-import { C as ComponentMeta, T as ThemeConfig, N as NavbarConfig, F as FooterConfig } from './types-D34wmivy.js';
-export { L as LayoutConfig, a as NavItem, P as PropDefinition, b as PropType, c as ThemeComponent } from './types-D34wmivy.js';
+import { C as ComponentMeta, c as ThemeConfig, a as NavbarConfig, F as FooterConfig } from './types-DCVaXlPV.js';
+export { L as LayoutConfig, N as NavItem, P as PropDefinition, b as PropType, T as ThemeComponent } from './types-DCVaXlPV.js';
 import React$1 from 'react';
 
 declare function createTheme(config: ThemeConfig): ThemeConfig;

package/dist/{types-D34wmivy.d.cts → types-DCVaXlPV.d.cts}

@@ -75,4 +75,4 @@ interface ThemeConfig {
     layout?: LayoutConfig;
 }
 
-export type { ComponentMeta as C, FooterConfig as F, LayoutConfig as L, NavbarConfig as N, PropDefinition as P, ThemeConfig as T, NavItem as a, PropType as b, ThemeComponent as c };
+export type { ComponentMeta as C, FooterConfig as F, LayoutConfig as L, NavItem as N, PropDefinition as P, ThemeComponent as T, NavbarConfig as a, PropType as b, ThemeConfig as c };

package/dist/{types-D34wmivy.d.ts → types-DCVaXlPV.d.ts}

@@ -75,4 +75,4 @@ interface ThemeConfig {
     layout?: LayoutConfig;
 }
 
-export type { ComponentMeta as C, FooterConfig as F, LayoutConfig as L, NavbarConfig as N, PropDefinition as P, ThemeConfig as T, NavItem as a, PropType as b, ThemeComponent as c };
+export type { ComponentMeta as C, FooterConfig as F, LayoutConfig as L, NavItem as N, PropDefinition as P, ThemeComponent as T, NavbarConfig as a, PropType as b, ThemeConfig as c };

package/dist/vendor-scope-DTYhJk_I.d.cts

@@ -0,0 +1,129 @@
+/** Canonical name for new installs / migrations */
+declare const ADMIN_GROUP_NAME = "Administrator";
+/** System administrator group (roles UI + users / user_groups / permissions bypass). */
+declare function isSuperAdminGroupName(name: string | null | undefined): boolean;
+type EntityCrudAction = 'create' | 'read' | 'update' | 'delete';
+type EntityPermissionFlags = {
+    c: boolean;
+    r: boolean;
+    u: boolean;
+    d: boolean;
+};
+declare function getPermissionableEntityKeys(entityMap: Record<string, unknown>): string[];
+declare function permissionRowsToRecord(rows: Array<{
+    entity: string;
+    canCreate: boolean;
+    canRead: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+}> | undefined): Record<string, EntityPermissionFlags>;
+declare function hasEntityPermission(record: Record<string, EntityPermissionFlags> | undefined, entity: string, action: EntityCrudAction): boolean;
+
+/**
+ * @deprecated Administrator bypass is now full entity access via `isRBACAdmin` in `sessionHasEntityAccess`.
+ * Kept for backwards-compatible imports.
+ */
+declare const RBAC_ADMIN_ONLY_ENTITIES: Set<string>;
+interface SessionUser {
+    id?: string;
+    email?: string | null;
+    name?: string | null;
+    groupId?: number;
+    /** User group display name (from login). */
+    groupName?: string | null;
+    /** @deprecated use entityPerms / isRBACAdmin */
+    permissions?: string[];
+    /** Administrator group: bypasses entity-level RBAC on all resources */
+    isRBACAdmin?: boolean;
+    entityPerms?: Record<string, EntityPermissionFlags>;
+    /** When false and not isRBACAdmin, admin API/UI is denied. */
+    adminAccess?: boolean;
+    /** Vendor stores this user can access (from vendor_users). */
+    vendorIds?: number[];
+    /** Active vendor for scoped CRUD (vendor staff). */
+    activeVendorId?: number | null;
+    /** Role for the active vendor link (`vendor_users.role`). */
+    vendorRole?: 'owner' | 'staff' | null;
+    /** Set at login: vendor store portal (not platform admin). */
+    isVendorPortal?: boolean;
+    /** Set at login: vendor store owner (team + permissions). */
+    isVendorOwner?: boolean;
+}
+declare function sessionHasEntityAccess(user: SessionUser | null | undefined, entity: string, action: EntityCrudAction): boolean;
+declare function canManageRoles(user: SessionUser | null | undefined): boolean;
+type GetSession = () => Promise<{
+    user?: SessionUser;
+} | null>;
+declare const OPEN_ENDPOINTS: Array<Record<string, string[]>>;
+declare const PERMISSION_REQUIRED_ENDPOINTS: Record<string, string[]>;
+declare function isOpenEndpoint(pathname: string): boolean;
+declare function getRequiredPermission(pathname: string): string[] | null;
+declare function isPublicMethod(pathname: string, method: string): boolean;
+interface AuthHelpers {
+    requireAuth(req: Request): Promise<Response | null>;
+    requirePermission(req: Request, permission: string): Promise<Response | null>;
+    requireEntityPermission(req: Request, entity: string, action: EntityCrudAction): Promise<Response | null>;
+    requireAdminAccess(req: Request): Promise<Response | null>;
+    getAuthenticatedUser(): Promise<SessionUser | null>;
+}
+declare function createAuthHelpers(getSession: GetSession, NextResponse: {
+    json: (body: unknown, init?: {
+        status?: number;
+    }) => Response;
+}): AuthHelpers;
+/** Pass return value into `createCmsApiHandler` (includes `getSessionUser` for vendor store APIs). */
+declare function createCmsAuthBundle(getSession: GetSession, NextResponse: {
+    json: (body: unknown, init?: {
+        status?: number;
+    }) => Response;
+}): {
+    requireAuth: (req: Request) => Promise<Response | null>;
+    requireAdminAccess: (req: Request) => Promise<Response | null>;
+    requireEntityPermission: (req: Request, entity: string, action: EntityCrudAction) => Promise<Response | null>;
+    getSessionUser: () => Promise<SessionUser | null>;
+    getAuthenticatedUser: () => Promise<SessionUser | null>;
+};
+
+/** Entities with a `vendorId` column (store data). */
+declare const VENDOR_SCOPED_STORE_ENTITIES: Set<string>;
+/**
+ * Store admin RBAC for vendor portal users (read/create/update/delete fallbacks in rbac-debug).
+ * Includes entities without `vendorId` that are still part of the store admin UI.
+ */
+declare const VENDOR_STORE_RBAC_ENTITIES: Set<string>;
+type VendorScope = {
+    type: 'all';
+} | {
+    type: 'vendor';
+    vendorId: number;
+    vendorIds: number[];
+} | {
+    type: 'deny';
+};
+declare const VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+/** User groups treated as vendor store staff (sidebar + scoped admin). */
+declare function isVendorGroupName(name: string | null | undefined): boolean;
+declare function isPlatformAdministrator(user: SessionUser | null | undefined): boolean;
+/** Vendor portal UI (store + store admin), not platform admin. */
+declare function isVendorPortalUser(user: SessionUser | null | undefined): boolean;
+declare function isVendorStaff(user: SessionUser | null | undefined): boolean;
+/** Vendor store owner (manages team + role permissions for their group). */
+declare function isVendorOwner(user: SessionUser | null | undefined): boolean;
+declare function canManageVendorTeam(user: SessionUser | null | undefined): boolean;
+declare function canManageVendorRoles(user: SessionUser | null | undefined): boolean;
+/** Platform admins (Administrator group) can onboard vendors. */
+declare function canOnboardVendors(user: SessionUser | null | undefined): boolean;
+declare function resolveVendorScopeFromSessionUser(user: SessionUser | null | undefined): VendorScope;
+/** Compute portal flags at login (persist on JWT). */
+declare function vendorPortalFlagsFromUser(input: {
+    email: string;
+    isRBACAdmin: boolean;
+    groupName?: string | null;
+    vendorIds?: number[];
+    vendorRole?: 'owner' | 'staff' | null;
+}): {
+    isVendorPortal: boolean;
+    isVendorOwner: boolean;
+};
+
+export { ADMIN_GROUP_NAME as A, type EntityCrudAction as E, type GetSession as G, OPEN_ENDPOINTS as O, PERMISSION_REQUIRED_ENDPOINTS as P, RBAC_ADMIN_ONLY_ENTITIES as R, type SessionUser as S, VENDOR_OWNER_GROUP_NAME as V, type AuthHelpers as a, type EntityPermissionFlags as b, VENDOR_SCOPED_STORE_ENTITIES as c, VENDOR_STORE_RBAC_ENTITIES as d, type VendorScope as e, canManageRoles as f, canManageVendorRoles as g, canManageVendorTeam as h, canOnboardVendors as i, createAuthHelpers as j, createCmsAuthBundle as k, getPermissionableEntityKeys as l, getRequiredPermission as m, hasEntityPermission as n, isOpenEndpoint as o, isPlatformAdministrator as p, isPublicMethod as q, isSuperAdminGroupName as r, isVendorGroupName as s, isVendorOwner as t, isVendorPortalUser as u, isVendorStaff as v, permissionRowsToRecord as w, resolveVendorScopeFromSessionUser as x, sessionHasEntityAccess as y, vendorPortalFlagsFromUser as z };

package/dist/vendor-scope-DTYhJk_I.d.ts

@@ -0,0 +1,129 @@
+/** Canonical name for new installs / migrations */
+declare const ADMIN_GROUP_NAME = "Administrator";
+/** System administrator group (roles UI + users / user_groups / permissions bypass). */
+declare function isSuperAdminGroupName(name: string | null | undefined): boolean;
+type EntityCrudAction = 'create' | 'read' | 'update' | 'delete';
+type EntityPermissionFlags = {
+    c: boolean;
+    r: boolean;
+    u: boolean;
+    d: boolean;
+};
+declare function getPermissionableEntityKeys(entityMap: Record<string, unknown>): string[];
+declare function permissionRowsToRecord(rows: Array<{
+    entity: string;
+    canCreate: boolean;
+    canRead: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+}> | undefined): Record<string, EntityPermissionFlags>;
+declare function hasEntityPermission(record: Record<string, EntityPermissionFlags> | undefined, entity: string, action: EntityCrudAction): boolean;
+
+/**
+ * @deprecated Administrator bypass is now full entity access via `isRBACAdmin` in `sessionHasEntityAccess`.
+ * Kept for backwards-compatible imports.
+ */
+declare const RBAC_ADMIN_ONLY_ENTITIES: Set<string>;
+interface SessionUser {
+    id?: string;
+    email?: string | null;
+    name?: string | null;
+    groupId?: number;
+    /** User group display name (from login). */
+    groupName?: string | null;
+    /** @deprecated use entityPerms / isRBACAdmin */
+    permissions?: string[];
+    /** Administrator group: bypasses entity-level RBAC on all resources */
+    isRBACAdmin?: boolean;
+    entityPerms?: Record<string, EntityPermissionFlags>;
+    /** When false and not isRBACAdmin, admin API/UI is denied. */
+    adminAccess?: boolean;
+    /** Vendor stores this user can access (from vendor_users). */
+    vendorIds?: number[];
+    /** Active vendor for scoped CRUD (vendor staff). */
+    activeVendorId?: number | null;
+    /** Role for the active vendor link (`vendor_users.role`). */
+    vendorRole?: 'owner' | 'staff' | null;
+    /** Set at login: vendor store portal (not platform admin). */
+    isVendorPortal?: boolean;
+    /** Set at login: vendor store owner (team + permissions). */
+    isVendorOwner?: boolean;
+}
+declare function sessionHasEntityAccess(user: SessionUser | null | undefined, entity: string, action: EntityCrudAction): boolean;
+declare function canManageRoles(user: SessionUser | null | undefined): boolean;
+type GetSession = () => Promise<{
+    user?: SessionUser;
+} | null>;
+declare const OPEN_ENDPOINTS: Array<Record<string, string[]>>;
+declare const PERMISSION_REQUIRED_ENDPOINTS: Record<string, string[]>;
+declare function isOpenEndpoint(pathname: string): boolean;
+declare function getRequiredPermission(pathname: string): string[] | null;
+declare function isPublicMethod(pathname: string, method: string): boolean;
+interface AuthHelpers {
+    requireAuth(req: Request): Promise<Response | null>;
+    requirePermission(req: Request, permission: string): Promise<Response | null>;
+    requireEntityPermission(req: Request, entity: string, action: EntityCrudAction): Promise<Response | null>;
+    requireAdminAccess(req: Request): Promise<Response | null>;
+    getAuthenticatedUser(): Promise<SessionUser | null>;
+}
+declare function createAuthHelpers(getSession: GetSession, NextResponse: {
+    json: (body: unknown, init?: {
+        status?: number;
+    }) => Response;
+}): AuthHelpers;
+/** Pass return value into `createCmsApiHandler` (includes `getSessionUser` for vendor store APIs). */
+declare function createCmsAuthBundle(getSession: GetSession, NextResponse: {
+    json: (body: unknown, init?: {
+        status?: number;
+    }) => Response;
+}): {
+    requireAuth: (req: Request) => Promise<Response | null>;
+    requireAdminAccess: (req: Request) => Promise<Response | null>;
+    requireEntityPermission: (req: Request, entity: string, action: EntityCrudAction) => Promise<Response | null>;
+    getSessionUser: () => Promise<SessionUser | null>;
+    getAuthenticatedUser: () => Promise<SessionUser | null>;
+};
+
+/** Entities with a `vendorId` column (store data). */
+declare const VENDOR_SCOPED_STORE_ENTITIES: Set<string>;
+/**
+ * Store admin RBAC for vendor portal users (read/create/update/delete fallbacks in rbac-debug).
+ * Includes entities without `vendorId` that are still part of the store admin UI.
+ */
+declare const VENDOR_STORE_RBAC_ENTITIES: Set<string>;
+type VendorScope = {
+    type: 'all';
+} | {
+    type: 'vendor';
+    vendorId: number;
+    vendorIds: number[];
+} | {
+    type: 'deny';
+};
+declare const VENDOR_OWNER_GROUP_NAME = "Vendor Owner";
+/** User groups treated as vendor store staff (sidebar + scoped admin). */
+declare function isVendorGroupName(name: string | null | undefined): boolean;
+declare function isPlatformAdministrator(user: SessionUser | null | undefined): boolean;
+/** Vendor portal UI (store + store admin), not platform admin. */
+declare function isVendorPortalUser(user: SessionUser | null | undefined): boolean;
+declare function isVendorStaff(user: SessionUser | null | undefined): boolean;
+/** Vendor store owner (manages team + role permissions for their group). */
+declare function isVendorOwner(user: SessionUser | null | undefined): boolean;
+declare function canManageVendorTeam(user: SessionUser | null | undefined): boolean;
+declare function canManageVendorRoles(user: SessionUser | null | undefined): boolean;
+/** Platform admins (Administrator group) can onboard vendors. */
+declare function canOnboardVendors(user: SessionUser | null | undefined): boolean;
+declare function resolveVendorScopeFromSessionUser(user: SessionUser | null | undefined): VendorScope;
+/** Compute portal flags at login (persist on JWT). */
+declare function vendorPortalFlagsFromUser(input: {
+    email: string;
+    isRBACAdmin: boolean;
+    groupName?: string | null;
+    vendorIds?: number[];
+    vendorRole?: 'owner' | 'staff' | null;
+}): {
+    isVendorPortal: boolean;
+    isVendorOwner: boolean;
+};
+
+export { ADMIN_GROUP_NAME as A, type EntityCrudAction as E, type GetSession as G, OPEN_ENDPOINTS as O, PERMISSION_REQUIRED_ENDPOINTS as P, RBAC_ADMIN_ONLY_ENTITIES as R, type SessionUser as S, VENDOR_OWNER_GROUP_NAME as V, type AuthHelpers as a, type EntityPermissionFlags as b, VENDOR_SCOPED_STORE_ENTITIES as c, VENDOR_STORE_RBAC_ENTITIES as d, type VendorScope as e, canManageRoles as f, canManageVendorRoles as g, canManageVendorTeam as h, canOnboardVendors as i, createAuthHelpers as j, createCmsAuthBundle as k, getPermissionableEntityKeys as l, getRequiredPermission as m, hasEntityPermission as n, isOpenEndpoint as o, isPlatformAdministrator as p, isPublicMethod as q, isSuperAdminGroupName as r, isVendorGroupName as s, isVendorOwner as t, isVendorPortalUser as u, isVendorStaff as v, permissionRowsToRecord as w, resolveVendorScopeFromSessionUser as x, sessionHasEntityAccess as y, vendorPortalFlagsFromUser as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@infuro/cms-core",
-  "version": "1.0.30",
+  "version": "1.0.33",
   "private": false,
   "type": "module",
   "main": "./dist/index.cjs",
@@ -122,7 +122,7 @@
     "lru-cache": "^11.0.0",
     "lucide-react": "^0.476.0",
     "next-themes": "^0.2.1",
-    "nodemailer": "^8.0.2",
+    "nodemailer": "^7.0.7",
     "papaparse": "^5.4.1",
     "pdf-parse": "^1.1.1",
     "pg": "^8.20.0",
@@ -130,6 +130,7 @@
     "cron-parser": "^4.9.0",
     "razorpay": "^2.9.6",
     "react-chartjs-2": "^5.3.0",
+    "react-qr-code": "^2.0.21",
     "reflect-metadata": "^0.2.2",
     "rss-parser": "^3.13.0",
     "sonner": "^2.0.6",

package/dist/helpers-dlrF_49e.d.cts

@@ -1,60 +0,0 @@
-/** Canonical name for new installs / migrations */
-declare const ADMIN_GROUP_NAME = "Administrator";
-/** System administrator group (roles UI + users / user_groups / permissions bypass). */
-declare function isSuperAdminGroupName(name: string | null | undefined): boolean;
-type EntityCrudAction = 'create' | 'read' | 'update' | 'delete';
-type EntityPermissionFlags = {
-    c: boolean;
-    r: boolean;
-    u: boolean;
-    d: boolean;
-};
-declare function getPermissionableEntityKeys(entityMap: Record<string, unknown>): string[];
-declare function permissionRowsToRecord(rows: Array<{
-    entity: string;
-    canCreate: boolean;
-    canRead: boolean;
-    canUpdate: boolean;
-    canDelete: boolean;
-}> | undefined): Record<string, EntityPermissionFlags>;
-declare function hasEntityPermission(record: Record<string, EntityPermissionFlags> | undefined, entity: string, action: EntityCrudAction): boolean;
-
-/** isRBACAdmin bypasses entity checks only for these (users / roles plumbing). */
-declare const RBAC_ADMIN_ONLY_ENTITIES: Set<string>;
-interface SessionUser {
-    id?: string;
-    email?: string | null;
-    name?: string | null;
-    groupId?: number;
-    /** @deprecated use entityPerms / isRBACAdmin */
-    permissions?: string[];
-    /** Administrator group: full access only for users, user_groups, permissions */
-    isRBACAdmin?: boolean;
-    entityPerms?: Record<string, EntityPermissionFlags>;
-    /** When false and not isRBACAdmin, admin API/UI is denied. */
-    adminAccess?: boolean;
-}
-declare function sessionHasEntityAccess(user: SessionUser | null | undefined, entity: string, action: EntityCrudAction): boolean;
-declare function canManageRoles(user: SessionUser | null | undefined): boolean;
-type GetSession = () => Promise<{
-    user?: SessionUser;
-} | null>;
-declare const OPEN_ENDPOINTS: Array<Record<string, string[]>>;
-declare const PERMISSION_REQUIRED_ENDPOINTS: Record<string, string[]>;
-declare function isOpenEndpoint(pathname: string): boolean;
-declare function getRequiredPermission(pathname: string): string[] | null;
-declare function isPublicMethod(pathname: string, method: string): boolean;
-interface AuthHelpers {
-    requireAuth(req: Request): Promise<Response | null>;
-    requirePermission(req: Request, permission: string): Promise<Response | null>;
-    requireEntityPermission(req: Request, entity: string, action: EntityCrudAction): Promise<Response | null>;
-    requireAdminAccess(req: Request): Promise<Response | null>;
-    getAuthenticatedUser(): Promise<SessionUser | null>;
-}
-declare function createAuthHelpers(getSession: GetSession, NextResponse: {
-    json: (body: unknown, init?: {
-        status?: number;
-    }) => Response;
-}): AuthHelpers;
-
-export { ADMIN_GROUP_NAME as A, type EntityCrudAction as E, type GetSession as G, OPEN_ENDPOINTS as O, PERMISSION_REQUIRED_ENDPOINTS as P, RBAC_ADMIN_ONLY_ENTITIES as R, type SessionUser as S, type AuthHelpers as a, type EntityPermissionFlags as b, canManageRoles as c, createAuthHelpers as d, getRequiredPermission as e, isPublicMethod as f, getPermissionableEntityKeys as g, hasEntityPermission as h, isOpenEndpoint as i, isSuperAdminGroupName as j, permissionRowsToRecord as p, sessionHasEntityAccess as s };

package/dist/helpers-dlrF_49e.d.ts

@@ -1,60 +0,0 @@
-/** Canonical name for new installs / migrations */
-declare const ADMIN_GROUP_NAME = "Administrator";
-/** System administrator group (roles UI + users / user_groups / permissions bypass). */
-declare function isSuperAdminGroupName(name: string | null | undefined): boolean;
-type EntityCrudAction = 'create' | 'read' | 'update' | 'delete';
-type EntityPermissionFlags = {
-    c: boolean;
-    r: boolean;
-    u: boolean;
-    d: boolean;
-};
-declare function getPermissionableEntityKeys(entityMap: Record<string, unknown>): string[];
-declare function permissionRowsToRecord(rows: Array<{
-    entity: string;
-    canCreate: boolean;
-    canRead: boolean;
-    canUpdate: boolean;
-    canDelete: boolean;
-}> | undefined): Record<string, EntityPermissionFlags>;
-declare function hasEntityPermission(record: Record<string, EntityPermissionFlags> | undefined, entity: string, action: EntityCrudAction): boolean;
-
-/** isRBACAdmin bypasses entity checks only for these (users / roles plumbing). */
-declare const RBAC_ADMIN_ONLY_ENTITIES: Set<string>;
-interface SessionUser {
-    id?: string;
-    email?: string | null;
-    name?: string | null;
-    groupId?: number;
-    /** @deprecated use entityPerms / isRBACAdmin */
-    permissions?: string[];
-    /** Administrator group: full access only for users, user_groups, permissions */
-    isRBACAdmin?: boolean;
-    entityPerms?: Record<string, EntityPermissionFlags>;
-    /** When false and not isRBACAdmin, admin API/UI is denied. */
-    adminAccess?: boolean;
-}
-declare function sessionHasEntityAccess(user: SessionUser | null | undefined, entity: string, action: EntityCrudAction): boolean;
-declare function canManageRoles(user: SessionUser | null | undefined): boolean;
-type GetSession = () => Promise<{
-    user?: SessionUser;
-} | null>;
-declare const OPEN_ENDPOINTS: Array<Record<string, string[]>>;
-declare const PERMISSION_REQUIRED_ENDPOINTS: Record<string, string[]>;
-declare function isOpenEndpoint(pathname: string): boolean;
-declare function getRequiredPermission(pathname: string): string[] | null;
-declare function isPublicMethod(pathname: string, method: string): boolean;
-interface AuthHelpers {
-    requireAuth(req: Request): Promise<Response | null>;
-    requirePermission(req: Request, permission: string): Promise<Response | null>;
-    requireEntityPermission(req: Request, entity: string, action: EntityCrudAction): Promise<Response | null>;
-    requireAdminAccess(req: Request): Promise<Response | null>;
-    getAuthenticatedUser(): Promise<SessionUser | null>;
-}
-declare function createAuthHelpers(getSession: GetSession, NextResponse: {
-    json: (body: unknown, init?: {
-        status?: number;
-    }) => Response;
-}): AuthHelpers;
-
-export { ADMIN_GROUP_NAME as A, type EntityCrudAction as E, type GetSession as G, OPEN_ENDPOINTS as O, PERMISSION_REQUIRED_ENDPOINTS as P, RBAC_ADMIN_ONLY_ENTITIES as R, type SessionUser as S, type AuthHelpers as a, type EntityPermissionFlags as b, canManageRoles as c, createAuthHelpers as d, getRequiredPermission as e, isPublicMethod as f, getPermissionableEntityKeys as g, hasEntityPermission as h, isOpenEndpoint as i, isSuperAdminGroupName as j, permissionRowsToRecord as p, sessionHasEntityAccess as s };